5.1.1 The Current Need for Data Access

As established in 2.1.2 and 2.2.4, people live digital lives, inevitably involving the use of myriad digital services that collect personal data, which is subsequently mined for value and exploited at scale, creating an imbalance of power between data holders and data subjects, and a exclusionary landscape around data use which is difficult for individuals to navigate: having acquired data about individuals, this becomes a focus for service providers’ decision-making and customer relations become less important. This everyday context is the chosen research setting for this case study.

Section 2.1.4 established how unaware many people are of this imbalance around data, that there is a want² for effective access to data to restore individual agency. As described in section 2.1.3, policymakers have been attempting since the 1970s to introduce legislation to tilt the balance of power back towards individuals, most recently and most notably the European Union’s General Data Protection Regulation, which legally endows at least 513 million individuals³ with new rights to timely data access, explanation, erasure and correction (Information Commissioner’s Office, 2018).

Data protection and misuse issues have grown in the public awareness since the Snowden revelations in 2013 (Gellman, 2013), and have become even more important following the Cambridge Analytica scandal in 2018 (‘Facebook–Cambridge Analytica Data Scandal’, 2014; Chang, 2018), which may have resulted in manipulation of voting outcomes through personal data use, and the COVID-19 pandemic in 2021 (O’Donnell, 2020; Hamon et al., 2021). Since the GDPR’s launch in May 2018, it has undoubtedly resulted in new data access offerings; many large consumer companies have developed ‘privacy hubs’ or improved privacy policies where individuals can learn how their personal data is handled or access data download portals to easily download copies of it (‘Privacy - Apple (UK)’, no date; ‘Privacy & Terms – Google’, no date; ‘Privacy’, no date; ‘Facebook - Data Policy’, no date). Almost all data controllers and processors have now updated their privacy policies to include clear processes for data subjects to request copies of their personal data per their GDPR access rights.

However, it is not known how effective these offerings and processes are for service users, and how individuals feel about them in light of this backdrop of public concern. No service providers make data access statistics publicly available, but anecdotal reports from industry insiders suggest GDPR access rights and data download dashboards are not well-known and hardly used. This presents an opportunity to take individuals who have not previously used these capabilities on a journey of discovery that might enable us to assess the impact of these processes over time and whether–by compelling data holders to create such offerings and respond to access requests–GDPR succeeds in its goals to ‘enhance the data protection rights of individuals’ (Council of the European Union, 2015) and to give people ‘control over their personal data’ (The European Parliament and the Council of the European Union, 2016).

5.1.2 Current GDPR Research and its Limitations

Since it came into effect in May 2018, the GDPR has opened up new possibilities for research (Comandè and Schneider, 2021); the ability to obtain one’s data records from organisations provides the general public with a potential deeper view inside those organisations, much like the UK’s Freedom of Information Act has provided a view into governmental and public sector organisations, enabling research and improving accountability (Savage and Hyde, 2014). Such legally-enforced transparency can also provide researchers with a window into organisations and their processes that was previously only available based on goodwill. Ausloos and Veale (Ausloos, 2019; Ausloos and Veale, 2020) provide an outline approach for using the GDPR in research as well as describing the many ethical and metholodogical considerations that should be made. GDPR research can however be as simple as inviting participants to exercise their rights of access and talking to them about the experience and any changes in their perspective, which is the approach this study uses, as detailed below.

The GDPR process itself has also been examined from many perspectives by researchers: to understand data holder’s compliance with legislation (Ausloos and Dewitte, 2018; Arfelt, Basin and Debois, 2019); to evaluate data portability (Wong and Henderson, 2018) and ‘privacy by design’ (Waldman, 2020); to compare its effectiveness in public/private sector contexts (Quinn, 2021) or in improving explainability (Hamon et al., 2021), fairness (Kasirzadeh and Clifford, 2021), consent (Human and Cech, 2021), transparency (Spagnuelo, Ferreira and Lenzini, 2019) and the reduction of data breach risks (Gonscherowski and Bieker, 2018). Potential negative impacts have also been considered; the GDPR could be seen as a threat to privacy (Bufalieri et al., 2020) or as an impediment to health research (Clarke et al., 2019).

Clearly GDPR has spurred a broad variety of research, spanning legal, social and technology domains. Yet, there is scant research into the individual human experience of the GDPR. Alizadeh et al. conducted a study with 13 users of a German loyalty programme and interviewed them before, during and after they made GDPR data requests (Alizadeh et al., 2019), finding better responses and GDPR education were needed. This is a good example of the sort of work that is needed to explore the human perspective on the GDPR journey, though this particular study was limited in breadth (only one service provider was targeted) and in depth (the data returned from companies was discussed largely at a high level of ‘were your expectations met?’ and potential to use the data for one’s own benefits was not examined). The implications of the experience upon the participants’ relationship with the provider were also not explored, it seems that impacts of data handling practice upon relationships is an under-researched area in general. Recent work (Bufalieri et al., 2020; Glavic et al., 2021; Zuckerman, 2021) has established that openness and transparency around data handling are key to services establishing individuals’ trust; indeed an echo of this was seen in a public sector context in Case Study One (see Chapter 4). In a commercial context, such changes in trust can impact customer satisfaction and business success.

At a more fundamental level, there is a need to understand the experience people have when using the GDPR; companies’ GDPR processes have been designed to comply with litigation rather than by focusing on individual needs or desires (Abowd and Mynatt, 2000; McCarthy and Wright, 2004; Wright and McCarthy, 2008) (for more details on experience-centred design refer to section 3.2). It is highly likely that some of these will have been overlooked. Such experiential understanding could inform the design of improvements to companies’ GDPR mechanisms, as well as identifying specific needs that might be best met through improvements to policy, including to the GDPR itself.

5.1.3 Human-Data Interaction: Towards a Human-centric Personal Data Ecosystem

Given the fact that data-centric services now span all aspects of our lives, and the amount of personal data about individuals has grown, it has become critical to think about the way people interact with data as a ‘whole life’ problem. This is one of the reasons this study focuses on the layman rather than a particular demographic, and ‘everyday services’ rather than a particular domain. Data has transcended the machine and now encodes facts about our lives, it exists across devices and across providers (Weiser, 1991; Mydex CIC, 2010; Abowd, 2012). This means that personal information management has become a sociotechnical problem (see section 2.3.3), that can no longer be solved as a filing-and-retrieval problem as per traditional PIM approaches (see 2.2.2), but only when considered as multi-party negotiation over representation, ownership, access and consent. It is important to evaluate the GDPR in this context. Up to now, individuals have not had the means to participate in or initiate such negotiations. On paper, it would seem that GDPR rights do convey this capability, but it is not known whether in practice, service providers’ responses to GDPR can actually deliver data subjects the ability to take part in negotiations around data in a fully-informed way. While some research on relationships around data and data as a shared resource is now emerging (see 2.2.5), the relationship with data-holding service providers has not been examined in this way.

A roadmap for best practice in this space can be found in the emergence of the ‘personal data ecosystem’ concept (see 2.3.4). Researchers have identified that a human-centric approach to personal data is needed, placing individuals at the centre, as controllers and overseers of their own personal data (Mydex CIC, 2010; Symons et al., 2017). This is an emergent space of much activity and research (‘Human Data Interaction Project at the Data to AI Lab, MIT’, 2015; ‘HDI Network Plus, University of Glasgow’, 2018; ‘HDI Lab, Heerlen’, 2020; BBC R&D, 2017; MyData, 2017; Symons et al., 2017; MyData.org, 2018) and provides a strong framing for us to evaluate the human experience of–and interaction with–the GDPR; given people’s diminished agency and control over their data (Woolgar, 2014; Crabtree and Mortier, 2016), do the GDPR’s access rights, as implemented by service providers, provide the effective access (Gurstein, 2011) people need? Does the GDPR help people to achieve legibility, agency and negotiability, the three tenets of Human-Data Interaction (see section 2.3.2 and (Mortier et al., 2014)).

This case study aims to explore the research gap identified in 5.1.2 above, from this perspective of greater human-centric need in a sociotechnical multi-party data use context. It will do so by scrutinizing the experience of using one’s GDPR rights to discover how well the process meets individuals’ needs and expectations; in the process the object is to uncover problems and identify possible solutions that could address them.

5.3.1 Interview 1: GDPR Target Selection

Initially eight participants chose 5 target companies and three chose 4 to request data from. One participant (P9) withdrew from the study due to COVID-19 after Interview 1. Five participants withdrew a chosen company upon further consideration. Reasons for withdrawing chosen targets included having one’s personal data mixed with other household members (Netflix), the account being in someone else’s name (Morrisons), not wishing to impact active customer support matters (LNER), and inability to contact the provider by email (ifun.tv, see below). One participant selected Newcastle University, which was vetoed by the research team to avoid conflicts of interest. Hence, 41 out of a possible 52 GDPR subject access requests were made (to 28 distinct data holders) as shown in Table 8:

Table: Table 8. Types of Data Holding Organisation Targeted for GDPR Requests by Study Participants^a

To ensure fairness and consistency, the aim was that all GDPR requests be sent by e-mail to the identified Data Protection Officer, requesting both a subject access request (Information Commissioner’s Office, 2021a) and a data portability request (Information Commissioner’s Office, 2021b) be initiated, and specifically enumerating and asking for those datapoints that the company stated in its privacy policy, as well as those which the GDPR entitles individuals to obtain. To identify these datapoints, company privacy policies were analysed and the necessary information was compiled in personaldata.io’s semantic wiki (‘List of target companies for GDPR requests’, no date) which has a feature to generate bespoke GDPR request emails, which we adapted and used (INSERT APPENDIX REF). Facebook, Apple, Huawei and Philips Hue do not offer a contact e-mail address, so the email text (shortened where length restrictions applied) was pasted into a contact form. In one case, entertainment website ifun.tv, the only available means of contact was via WeChat, resulting in the participant (a Chinese citizen) choosing not to contact ifun.tv due to fear of Chinese government surveillance. From our analysis of companies’ privacy policies and with reference to GDPR rights, we constructed a taxonomy of the types of personal data that could be returned, using terms from those privacy policies and GDPR legislation: there are five types of personal data, as shown in Table 9.

Table: Table 9. Types of Personal Data Potentially Accessible from Data Holders via GDPR Rights

5.3.2 Interview 2: Privacy Policy Review and Goal Setting

Participants reviewed and discussed privacy policies for their chosen target companies and were asked to define hopes and expectations for each GDPR request (see Table 12). These most commonly related to seeing the breadth and depth of data collection by companies, understanding what was being inferred and how personal data was used, and to use such information to better assess trustworthiness of those companies. Other motivators included the desire to reflect on one’s own past data to gain self-insight, and to take control of or delete held data. Minor motivators included learning, creativity, fun, nostalgia, curiosity and the desire to shed light on specific incidents or answer specific questions.

At the conclusion of interview 2, participants were provided with the emails and instructions to start their GDPR requests, which progressed as illustrated in Figure 25. Eight requests resulted in no data being obtained, due to either data holder non-responsiveness, inability to access the right account or satisfy ID requirements, or confirmation being received that there was no data to supply. 32 requests (80%) resulted in at least some data being returned; 10 of these directed the participant to use a publically-available download dashboard such as Google Takeout, and the rest resulted in data being made individually available. Of these, one was mailed as printouts, another was mailed on CD-R, and the rest were delivered by e-mail (sometimes involving a secured online website to download). While 22 companies supplied bespoke data packages, 4 did not return it within the 30 days the legislation specifies (note: requests took place within the context of a global pandemic so response rates may not be typical). Following discussion, participants judged that all 32 requests receiving data had failed to return all requested data (across all five of the categories in Table 9).

5.3.3 Interview 3: Reviewing the GDPR Response

Once each participant’s GPDR requests had reached a conclusion point (as described above), they were invited to discuss the GDPR response in detail. Participants were asked to describe (and optionally show) the data they had received, then to evaluate the data holder’s response for each data type, according to multiple metrics designed to assess the perceived quality of the GDPR request handling and the subjective value of any returned data. All questions were posed from the perspective of (a) the data that providers said they collect and process in their privacy policies, and (b) the rights that the GDPR specifies, to ensure discovery of missing data or unfulfilled rights would be considered objectively. Participant responses were considered quantitatively (cf. Table 10) and qualitatively (cf. section 5.4).

Table: Table 10. Presence and quality assessments of GDPR responses by data type (as percentages^a)

Table 10 shows quality assessments for each data type, with rows descending by subjective value. Notably, the kinds of data participants value most (derived, acquired and metadata) were less frequently returned, especially metadata (returned in 4% of cases). Where data was returned in these categories, it suffered from poor data quality, often judged as incomplete, inaccurate, unusable and not useful (although acquired data was largely understandable). At 53%, even the most returned category, volunteered data, was lacking. Where it was returned, accuracy (92%), meaningfulness (72%) and understandability (72%) were high. Observed data was least valued and also rarely returned or complete (yet judged to be of moderate quality). Across all data types, data was only judged to be complete in 22% of cases, and in 62% of cases personal data specified in privacy policies to be collected was not returned, despite the legal obligation.

The above quality and coverage datapoints also allowed us to extract some information about which service providers were strongest or weakest in each category, and overall. This was done by tallying the “Yes” responses for each category and overall, then dividing by the number of times that provider was selected, to avoid inflating scores for popular companies. The outcome of this analysis is shown in Table 11. The companies that fared worst overall were those that did not return any data at all in response to a GDPR request (Sainsbury’s, Freeprints, Tyne Tunnels, LinkedIn, Huawei, Bumble, LNER). As a caveat, it should be noted that Sainsbury’s and Huawei did respond, claiming to hold no data for the requesting participant. The other named companies here did not respond at all, despite at least two follow-up emails being sent to them, and despite in some cases having initially acknowledged and promised to satisfy the request.

Companies producing responses with good coverage and good quality included Niantic, Nectar and Sunderland AFC as well as to a lesser extent Natural Cycles, Revolut, Spotify, Tesco and Amazon. Facebook and Google fared well for the breadth of data returned (due in part to their download dashboards), though the quality of Google’s data was found lacking across multiple categories. Last.fm (owned by CBS) fared poorly overall due to poor category coverage, despite the data that it did return being of high quality.

Table: Table 11. Best and Worst Data Holders in Different Categories, According to Participants’ Judgements^a

At the conclusion of the final interview, participants were reminded of the specific hopes and anticipated data uses they had expressed at the start of their journey and asked about how well each goal had been met. These answers were recorded and combined to produce percentage values showing in how many cases goals were fully met, partially met, or not met at all, as shown in Table 12.

Participants felt their goals were not fully met in 78% of cases, and 54% were not met at all. Specific shared problem areas included (1) the desire to understand what providers infer from held data (7 participants), which was unmet in 73% of cases and only fully met in 7% of cases; and (2) the desire to delete one’s data, which was a stated goal in 10 cases but was only met in one of them. Four wholly unmet hopes were to investigate specific incidents (GDPR responses were often delivered as a one-off package without any kind of backchannel or opportunity to ask questions), to secure data, to check accuracy, and to move data to another service.

Table: Table 12. Participants’ hopes, imagined data uses and goals for GDPR, as well as resultant outcomes

5.3.4 Perceived Power and Trust

The research team examined how participants’ feelings towards the data holders changed throughout the process. Participants were asked to assess trust from 0 (total distrust) to 10 (total trust). They were asked to assess their perceived power on a scale of -5 (total provider power) through 0 (balanced power) to +5 (total individual power). Participants were invited to explain their reasoning for initial ratings and for any changes. By repeating the same question at different times, longitudinal comparisons could be made. Changes in attitude were observed; these changes are summarized in Figure 26. Many participants’ attitudes did change as a result of the experience, for both perceived power (45% of cases) and trust (66% of cases). For those with changed attitudes, the change was often negative: in 63% of cases where participants perceived a change in individual power, that change was a loss in individual power, and in the majority (52%) of cases, participants felt more distrustful of GDPR targeted companies after completing the process (constituting 79% of cases where a change in trust was perceived). However, it is important to note that in some cases GDPR had a positive impact; in 17% of cases participants felt their perceived power had increased, and in 14% of cases participants felt more trusting of providers after GDPR.

Looking deeper into these datapoints, changes in attitude could be attributed both to the impact of reviewing the privacy policy as well as to the experience of the GDPR process and the discursive review of GDPR responses. Figures 27 and 28 show snapshots of power and trust ratings at different points in the process which illustrate these impacts. Looking to explain these changes qualitatively, it was found that privacy policies often contradicted participants’ expectations, resulting in discomfort. In two cases (Philips Hue and last.fm) privacy policy review revealed that the service relationship was with a completely different company than the participant thought, which was disturbing to them. LinkedIn’s privacy policy was noteworthy as being exceptionally clear, reassuring and trust-enhancing to the participant, largely due to its ‘easy read’ text sidebars but also good use of examples. Google’s privacy hub with its video explainers was considered easy to understand but necessarily broad (given their breadth of services) and thus over-simplified, raising uncertainty about generalisations made, and in some cases increasing distrust.

Considering the process as a whole, participants’ attitudes were impacted particularly by the “hassle” (P11) they experienced in getting through the data access process, and from the realization that what seemed at first glance to be a thorough response, when examined more deeply in Interview 3 and viewed through the lens of the privacy policy promises and one’s GDPR rights to the five categories of data, was in fact quite poor.

5.4.1 Themes & Subthemes

[convert this to prose]

1. Insufficient Transparency (Theme 1): Organisations appear evasive over data when responding to GDPR, leaving people “in the dark” even after making GDPR requests.
2. Confusing Data (Theme 2): When presented with their data, people struggle to understand it and relate it to their lives and are not able to make use of it.
3. Fragile Relationships (Theme 3): Companies’ data practices, and in particular their privacy policies and GDPR response handling, can be impactful to customer relationships, carrying a risk of damaging trust but also the potential to improve relations. These themes are detailed in 5.1, 5.2 and 5.3 respectively.

[insert Table for each of the three themes]

5.4.2 Theme 1: Many Companies are Evasive and People are “Still in the Dark”

5.4.3 Theme 2: People Struggle to Understand, Use and Relate to Their Data

5.4.4 Theme 3: Poor GDPR Handling Can Damage the Fragile Trust Relationship

5.5.1 Policy Implications: Compliance, Quality and Ongoing Access

Despite significant and obvious investment in dashboards, processes and bespoke data package production, our findings indicate that inadequate compliance with the GDPR is common. Generalisability of our findings is limited by the small number of participants, but they are consistent with literature: the participants’ issues with completeness and compliance echo those first reported within the GDPR’s first year [9], suggesting completeness and compliance have not improved. However, the focus was on the effectiveness and experience of engaging with GDPR procedures from the individual’s perspective. Our participants’ experience was overwhelmingly one of disappointment and frustration, with their hopes rarely met. They found that data holders often did not engage meaningfully with the process, and that the responses typically excluded or obscured data that could have provided them with the insights into their data privacy and the organisation’s data practices that they sought. Evaluations of perceived power compared to data holders largely remained the same or worsened after accessing data through GDPR, and confidence in the capabilities of the legislation to shift the balance of power was lacking. The process was perceived by some as a “box-ticking exercise” that was both frustrating and time-consuming and did not ultimately help them. Even though in 7% of cases participants did feel empowered by the GDPR, all participants receiving data were in practice left with additional time-consuming and sometimes technically-skilled work to take advantage of or interpret their returned data. This suggests that to improve, policymakers need to make changes towards:

1. Better Compliance Through Enforcement of Complaints. At present, enforcement of the GDPR is uneven; each country has its own DPA (for example in the UK, this is the Information Commissioner’s Office or ICO) and complaints are rarely pursued for individual cases. Instead, cases are processed by specific DPAs in a form similar to a class action lawsuit. This means that individuals have little impact when they do raise a complaint, and many GDPR complaints “become lost or resulted in lengthy delays” [21], or may even be erroneously dropped [72]. Until individuals have a clear and effective means to issue complaints [11] that result in enforcement action (or a clear threat of it), it is likely that individuals will continue to have little recourse other than to repeat the request and hope similarly dissatisfied individuals will act on their behalf. Data holders must be held to account when they do not deliver the full set of data that they report possessing, or when they fail to do so within the legally obligated time frame.
2. Policies to Enforce Better Quality Responses. Many participants received data in frustrating formats, including screenshots, printouts or files that were too technical or littered with acronyms. Data was provided in formats too technical to understand, or not technical enough to be usable (see 5.2), showing a demand for both human-readable information summaries and machine-readable data files, where most providers typically provide only one or the other. Policymakers could provide suggested data formats or even propose new standards; this would help data portability, improve effectiveness [44] and legibility [80], can reduce costs through common tooling and catalyse the building of tools to interpret and understand data. Such standards are emerging [78] as they are a technological necessity for data unification, but lack adoption.
3. Policies to Enforce Data Access as Ongoing Support, not One-Time Delivery. A radical redesign of policy is needed to give people the practical outcomes they desire and, according to the GDPR itself, deserve. Data access needs to be seen as more than “the delivery of data files”. People need understanding of their data and of its handling, and this is the measure by which compliance should be assessed. The explanations GDPR mandates are not forthcoming; of the 119 hopes expressed by participants (see Table 5), 70 (59%) related to acquiring greater understanding of data practices. 38 (54%) of these were unmet, and a further 15 (21%) were only partially met. By mandating data holders to support individuals with not just the delivery of data, but assistance to understand that data, policies could become more impactful, not least because such understanding is critical to inform judgements around consent, loyalty and compliance.

5.5.2 Implications for Business Data Practices: Earn Trust through Opening Up Data

While this study, and the GDPR itself, might seem adversarial to data holders given the goal to reduce their power by imposing new procedures, our findings emphasise the role of personal data in consumer relations. Data holders are likely aware of the paramount role of personal data in decision-making, but may not be aware of individuals’ perceptions about this. Our findings suggest that failure to satisfy users who are concerned about the collection and usage of their personal data risks harms to consumer trust and confidence. In turn, however, this presents opportunities to use the mechanisms of the GDPR for customer loyalty and building better relations. In 52% of cases, following our process of examining privacy policies and engaging in GDPR data requests resulted in a decrease in reported trust in the data holder. While such impacts may for now be minimal, as only a small proportion of users read privacy policies [92] and—one can assume—an even smaller number conduct GDPR requests, this is likely to change as issues around data privacy and trust continue to take centre stage in global geopolitics [98,107]. Furthermore, the growing number of businesses focused on “getting your data” or “taking control” [25,40,97,116–118] suggest demand for data access is growing. , this is likely to change as issues around data privacy and trust continue to take centre stage in global geopolitics [98,107]. Furthermore the growing number of businesses focused on “getting your data” or “taking control” [25,40,97,116–118] suggest demand for data access is growing. Our findings offer three positive takeaways for data holders: 1) Data transparency is an opportunity to increase customer loyalty and trust. GDPR’s basic rights provide a starting point for delivering practical data transparency that will allow organisations to demonstrate that they are deserving of trust. By responding clearly and engaging openly and helpfully with GDPR data requests, organisations can demonstrate consistency between their privacy policy and their actions and demystify to their users the role that data holds in their business model. Research has shown that explanations can “ease humans’ interactions with technology […], help individuals understand a system’s function, justify system results, and increase their trust” [42]. In 14% of cases, our participants felt more trusting of the service brand as a result of their GDPR experience (sometimes even displacing prior apprehensiveness or distrust), citing reasons such as speedy, hassle-free responses, clear and understandable data, providers being upfront and open with data, and staff who exhibited a positive attitude to the request. 2) Data transparency is an opportunity for improved and re-imagined customer relations around data. Beyond the opportunity to improve trust, the mechanisms of data transparency suggested by the GDPR provide individuals with new capabilities for data curation and involvement. By offering individuals the ability to engage in empowering data interactions, data holders have the opportunity to improve engagement with their organisation and their services. If organisations view personal data as a shared resource to be curated and co-owned by the individuals that contributed it, there may be correspondingly shared benefits: for the individual, a sense of agency, influence and negotiability [80]; and for the service provider, an incentive for individuals to generate and share more data, an increased likelihood of individuals correcting inaccurate data, and more reliable and human-centric forms of ongoing consent closer to dynamic consent [61] than today’s ineffective models of informed consent [73]. 3) New customer demands indicate untapped business opportunities. As the 500-member-strong MyData Global organization [82] shows, there is growing demand for personal data empowerment. People’s personal data is splintered and trapped [1,16], and they cannot correlate data from different sources in order to reflect upon it, gain insights, and set goals [70]. Due to commercial motivations, service providers generally deliver capabilities within a closed silo, not at the level of one’s wider environment [2]. To be better empowered the individual could be the point of integration, the centre of their own Personal Data Ecosystem (PDE) [81]. Life-level capabilities [17] and the opportunities that well-designed and well-regulated GDPR-type regulations promise in this regard have not yet been exploited. Thorough, complete and timely data access in standard formats, as mentioned above, will be critical to enabling this vision. Growing companies such as CitizenMe [119], Digi.Me [38], Mydex [125], ethi [58], HestiaLabs [34], udaptor [97] and exist.io [120] as well as larger organisations like BBC R&D [13] and Microsoft [75] are already starting to innovate in this space.

5.5.3 Individual Action: Becoming Aware of the Value and Power of Data

While participants experienced disappointment and frustration in their GDPR journeys, all participants gained new understandings; if not always of their data itself, at least of their target companies’ approach to data access requests. This new knowledge was sufficient to re-affirm or challenge existing attitudes or inform judgements –P1, for example, left Facebook after the study. Even an attempt to access data can be educational, and even a cursory look at a provider’s ‘What data do we collect’ privacy policy section can provide pause for thought. Today, individuals remain largely in the dark about the collection, use and sharing of their data through a combination of perceived complexity and effort combined with a lack of clear benefits. Table 4, alongside the increased control and insight promised by the PDE movement and platforms linked in 6.1 and 6.2 above, provide a glimpse of what the future may hold: a world where individuals take more control of their data and gain actionable self-insights. Three key messages for individuals can be inferred: 1) Your data is used to represent you and define your user experience. We hand over our data in exchange for access to services, but providers then use it (usually in aggregate) e.g. to inform product design or decide what content you see. This ‘innocent’ handover of data is in fact giving providers the means by which we are treated and – at times – controlled. Recognizing the crucial role of data (and our limited influence over it) is the first step to pursuing greater agency and control. 2) Your data contains meaningful and valuable data about your life. Data, as our participants found, is dry and technical, but they all sought meaning and value within it (cf. 5.2.2). Within data lies potentially rich information about one’s life and past activity – some of which can even be inaccessible through any other means. This highlights both a risk (that others might gain this insight) and a potential benefit (that we could access this insight ourselves). In this context, data deletion without keeping a copy may be inadvisable. To access the value in data, individuals will need to demand data standards, better access and control mechanisms and insight tools. 3) Self-education and awareness enable accountability and informed choices. Our findings highlight a lack of knowledge. Transparency is critical to judging ‘to what extent the bargain is fair’ [66]. It is not always delivered, but GDPR makes it your right; a right that cannot be fully refused. Through challenging poor GDPR responses and demanding better information, individuals can have impact. Providers are ultimately motivated by public demand—one of the reasons download dashboards exist. Through the public pressure of negative attention, companies can be motivated to improve data access [33]. With patience, GDPR rights can be exploited to force small changes.